restrict update tickets to users witih permission